I wrote a module to enable Okta authentication policy without having to think about the intricacies (src). Essentially, policy in plain english. Click here for the original post.